Hypothesis registry

Over all 27 states of gold and two verdicts, routing is unsafe exactly when both reads share the same wrong decisive verdict, is never unsafe where either read alone is safe, flag only review is unsafe only where the proposal is unsafe, and rewriting review creates unsafe states from safe proposals.

Rejection test: Enumeration holds, and the routing identity holds on 1,672 of 1,672 recorded pairs.

Witness D's read is FAIL on at least 18 of 24 track H near miss items; its resamples reproduce at least 80 percent of those wrong decisive verdicts; its deliberate read moves at least 8 of the 24 to HOLD.

Rejection test: FAIL on 22 of 24; resamples reproduced 58 of 70 (interval 0.7238 to 0.8991); deliberate HOLD on 10 of 24.

Each of route(D, B), route(D, C) and route(D, D deliberate) has fewer unsafe outcomes than route(D, D resample 1), with at least two McNemar tests below 0.05.

Rejection test: 3, 8 and 14 unsafe against 29; all three p below 0.05.

Across eleven second reads paired with Witness D, Spearman correlation between disagreement (without gold) and unsafe outcomes removed by routing is at least 0.7.

Rejection test: rho = 0.9495.

route(D, D deliberate) beats route(D, D resample 1), and removing the HOLD case from the deliberate prompt removes the benefit.

Rejection test: 14 against 29 unsafe; HOLD ablation 26 against 15.

For route(D, B), route(D, C) and route(D, D deliberate), unsafe outcomes removed relative to Witness D's read are at least the false holds added.

Rejection test: 32 against 11; 27 against 1; 21 against 16.

For at least two of Witnesses B, C and D, the rate of keeping a seeded wrong verdict exceeds the rate of reaching that same wrong verdict on a blind read, McNemar p below 0.05.

Rejection test: No reviewer showed a significant excess; Witness B kept 2 seeds against 3 blind errors, Witness C 3 against 9, Witness D 29 against 35.

Flag only review of Witness D creates no new unsafe outcome and has no more unsafe outcomes than rewriting review; rewriting review creates at least one new unsafe outcome.

Rejection test: Flag only created 0 new unsafe and left 5; rewriting created 0 new unsafe and left 11.

A stored conclusion raises Witness D's unsafe outcomes; a stored procedure lowers them; removing the open record steps removes the benefit; each with p below 0.05.

Rejection test: 33 against 35 (p = 0.753906); 26 against 35 (p = 0.022461); 28 against 26 (p = 0.753906). Parts a and c fail.

At least 90 percent of unsafe decisive outputs with a nonempty quote copy the packet exactly, and the Wilson lower bound is at least 0.8.

Rejection test: 393 of 395 exact quotes (0.9949, interval 0.9817 to 0.9986).

Witness D releases at least 10 unsafe verdicts on track H; each reader's temperature 0 repeat agrees on at least 95 percent of usable items.

Rejection test: Part a supported: 35 unsafe on track H. Part b rejected: repeats 134 of 152, 146 of 152 and 136 of 152.

In at least 5 of 6 track H domain groups, route(D, B) and route(D, D deliberate) each have no more unsafe outcomes than route(D, D resample 1).

Rejection test: Both hold in all 6 groups.

On at least two of the three surfaces (table, log, letter), route(D, B) and route(D, D deliberate) each have no more unsafe outcomes than route(D, D resample 1).

Rejection test: Both hold on all 3 surfaces.

Structural: routing is unsafe exactly when both reads share the same wrong decisive verdict, is never unsafe where either read alone is safe, flag only review is unsafe only where the proposal is unsafe, and rewriting review creates unsafe states from safe proposals.

Rejection test: Enumeration of 27 states and 2067 of 2067 recorded routing identities.

Replication: Witness D is FAIL on at least 7 of 9 Round 49 near miss items; its resamples reproduce at least 80 percent of those wrong decisive verdicts; its deliberate read moves at least 3 of the 9 to HOLD.

Rejection test: FAIL on 9 of 9 near misses; resamples reproduced 18 of 18; deliberate HOLD on 5 of 9.

Each of route(D, B), route(D, C) and route(D, D deliberate) has fewer unsafe outcomes than route(D, D resample 1); at least two McNemar tests give p below 0.05.

Rejection test: Route with B, C and D deliberate: 4, 18 and 13 unsafe against 35 for D resample; all three p below 0.05.

Across eleven second reads paired with Witness D, Spearman correlation between disagreement (without gold) and unsafe outcomes removed by routing is at least 0.7.

Rejection test: Spearman rho = 0.968 across 11 second reads.

route(D, D deliberate) beats route(D, D resample 1); removing the HOLD case from the deliberate prompt removes the benefit.

Rejection test: Both parts: deliberate routing beat resample routing (p = 0.0); HOLD ablation raised unsafe verdicts (p = 2.1e-05).

For route(D, B), route(D, C) and route(D, D deliberate), unsafe outcomes removed relative to Witness D's read are at least the false holds added.

Rejection test: Unsafe removed at least matched false holds added for B, C and D deliberate.

For at least two of Witnesses B, C and D, the rate of keeping a seeded wrong verdict exceeds the rate of reaching that same wrong verdict on a blind read, McNemar p below 0.05.

Rejection test: No reviewer showed a significant excess of keeping the seeded wrong verdict over its own blind error; Witness C kept fewer.

Flag only review of Witness D creates no new unsafe outcome and has no more unsafe outcomes than rewriting review; rewriting review creates at least one new unsafe outcome.

Rejection test: Flag only review created 0 new unsafe verdicts and had fewer residual unsafe verdicts than rewriting, but rewriting also created 0 new unsafe verdicts.

A stored conclusion raises Witness D's unsafe outcomes; a stored procedure lowers them; removing the open record steps removes the benefit; each with p below 0.05.

Rejection test: On Witness D, stale p = 0.070312, procedure p = 0.125, ablation p = 0.34375, all above 0.05.

At least 90 percent of unsafe decisive outputs with a nonempty quote copy the packet exactly, and the Wilson lower bound is at least 0.8.

Rejection test: 526 of 529 exact quotes, interval 0.9835 to 0.9981.

Witness D releases at least 10 unsafe verdicts on track G; each reader's temperature 0 repeat agrees on at least 95 percent of usable items.

Rejection test: Both parts: 29 unsafe on track G; repeats at or above 95 percent.

In at least 5 of 6 track G domain groups, route(D, B) and route(D, D deliberate) each have no more unsafe outcomes than route(D, D resample 1).

Rejection test: Both different-read routes had no more unsafe outcomes than resample routing in all 6 groups.

Over all 81 states of gold and three verdicts, the unsafe states of three reader unanimity are a strict subset of those of recovery, which are a strict subset of those of majority, and every unsafe recovery state has two reads sharing the same wrong decisive verdict.

Rejection test: Unsafe states 4, 20 and 28 of 81, strictly nested; the shared wrong verdict condition holds in every unsafe recovery state.

With the identical Round 49 prompt and packets, Witness D's single read is decisive on at least 5 of the 9 Round 49 near miss items.

Rejection test: FAIL on 9 of 9, matching Round 49 on 36 of 36 items.

At two calls, routing Witnesses C and D has fewer unsafe outcomes than routing either reader with its own resample, pooled over all items.

Rejection test: Routing C and D released 6 unsafe verdicts against 5 for Witness C with its own resample.

Routing Witnesses C and D does not dominate routing the better of the two readers with its own resample: it pays at least as many false holds.

Rejection test: 6 against 5 unsafe and 1 against 1 false hold.

One Witness D call with twice the output allowance and a counter case step has no more unsafe outcomes than Witness D's two call self routing.

Rejection test: 2 unsafe on 69 usable items against 9; at most 9 if every unusable output were unsafe.

At three calls, recovery (Witness D read, Witness C validation, Witness B adjudicator) has no more unsafe outcomes than three reader unanimity and fewer false holds.

Rejection test: Recovery released 5 unsafe verdicts against 0, with 1 false hold against 2.

Cross validation changes more of Witness D's wrong decisive reads to gold or HOLD than self validation.

Rejection test: 2 of 7 against 0 of 9; cross validation also turned one correct HOLD into PASS.

Manipulation check: each of Witnesses B, C and D makes at least one decisive error on the replicated or table tracks, and at least one reader is decisive on at least one SEC payment claim.

Rejection test: Witness B made no decisive error, no reader erred on the table track, and no reader was decisive on an SEC payment claim.

In both non-document domains an exact evidence span gate admits every wrong status mutation, and a visible example execution gate admits every subtle code defect as PASS.

Rejection test: 64 of 64 wrong mutations pass the span gate; 4 of 4 subtle defects pass example execution.

In each non-document domain at least one live decisive wrong read cites only exact packet evidence.

Rejection test: No decisive wrong read on tables; the only decisive code read differing from labels is correct under the corrected gold.

In each non-document domain at least one reader returns a decisive verdict on an open dependency HOLD item.

Rejection test: Every genuinely open dependency was held by every reader; X01H was not genuinely open.

Agreement routing of Witnesses C and D yields no more unsafe outcomes than the better single reader in each domain, with a false hold cost.

Rejection test: No unsafe routed outcome, but no unsafe single read to stop on code or tables; one false hold appears only under corrected gold.

With natural baselines, preservation loses at least one correct decisive repair, and independent recovery restores at least one without admitting a wrong decisive change.

Rejection test: Zero of 53 rewrites changed status, so neither effect could occur live.

Under recovery, every unsafe state that preservation would have blocked has the rewrite and the independent reader sharing the same wrong decisive verdict.

Rejection test: Eight added unsafe states, all with a shared wrong decisive verdict; four of 12 lost repair states restored.

At least one same wrong decisive agreement survives routing in each domain under no memory.

Rejection test: No same wrong decisive agreement in either domain.

Procedure memory reduces same wrong decisive agreements without more false holds in either domain.

Rejection test: No unsafe agreement to reduce; common item paired accuracy (16 of 21) and false holds (5) unchanged.

Exact span validation admits at least one naturally wrong rewrite from a correct input.

Rejection test: Supported narrowly: seven quote valid wrong live status changes, all false holds on contestable wording.

Status preservation routes every naturally wrong status change from correct inputs, and every status changing repair of a wrong input.

Rejection test: Supported as gate behavior: 7 damaging changes and 22 correct repairs routed; eight wrong unchanged statuses admitted.

Removing the second read does not improve safety, though it can improve endpoint accuracy by avoiding false holds.

Rejection test: Consistent, safety benefit unmeasured: one or two correct outcomes recovered; all compared unsafe counts are zero.

Structurally, quote validity cannot certify semantic status and agreement cannot certify truth.

Rejection test: 48 semantic mutations pass quote checking; four joint verdict states remain unsafe.

A stale stored note lowers Witness D accuracy relative to no memory, and Witness D follows the stale conclusion on at least 9 of 36 items.

Rejection test: MS 27 against M0 26; 0 stale follows.

A correct stored note is at least as accurate as no memory for Witness D.

Rejection test: MC 27 against M0 26, identical to MS and MG; uninformative because the correct note fixed none of the near miss errors.

The guarded note is followed less often than the stale note, and guarded accuracy is within 2 items of no memory in each domain.

Rejection test: MG and MS both have 0 stale follows; MG is within 2 of M0 in both domains.

A procedure card is at least as accurate as no memory with no more unsafe verdicts.

Rejection test: MP 30 against M0 26; unsafe 4 against 9; 2 false holds against 1.

The directions in H49.1 and H49.3 hold in both domains.

Rejection test: No stale pull in either domain; the procedure card gain appears in both domains.

Under a stale note, Witness C gives the stale wrong verdict on more items than under no memory.

Rejection test: Witness C has 0 stale follows under MS.

Under a wrong brief, the locked final is at least as accurate as the unlocked revision; under a right brief, the locked final is at least as accurate as the provisional.

Rejection test: Locked equals provisional under both briefs; one wrong revision blocked. Barely exercised.

At least one note style yields nonzero live note following on HOLD exhibits, and the gate routes every followed release.

Rejection test: 0 of 24 notes followed.

R48 releases cures that R47 holds on gold ledgers, with no added unsafe release under scripted M2.

Rejection test: Gold: R48 releases 5 of 5 Domain A and 4 of 4 Domain B cures that R47 holds. M2 unsafe remains zero. Live Witness C already released all five R items under both rules. Live Witness B ledgers (completed post hoc): open 12 to 15 correct, 0 unsafe.

R48 still removes the scripted schedule threshold release.

Rejection test: Under scripted M2, R48 produces zero unsafe releases.

Extract first then brief (V4 final) is at least as accurate as packet only (V1) and follows wrong resolver holds less often than V3.

Rejection test: V4 final is 14 of 20 against V1 on 18. V4 provisional matches V1 at 18. Wrong holds followed: V4 final 2 against V3 4.

On Domain B, extract first (V4) is at least as accurate as packet only (V1).

Rejection test: Domain B V1 is 16 of 16; V4 final is 14 of 16.

C1 with R48 escapes no more unsafe releases than C1 with R47.

Rejection test: Both escape zero, making the safety comparison uninformative.

The validator follows a note on at least one HOLD exhibit and the gate routes every such release.

Rejection test: Live note following is zero on all 24 exhibits.

R47 releases cures that R46 holds on gold and live ledgers, with no added unsafe release.

Rejection test: R47 releases zero of five gold cures. Live open gains are partial, 10 to 13 on Witness C and 12 to 13 on all 20 Witness B items (6 completed post hoc), with no added unsafe outcome.

R47 still removes the scripted schedule threshold release.

Rejection test: Under scripted M2, R47 produces zero unsafe releases and ten false holds. Exploratory R47c produces ten unsafe releases.

The independent reviewer with packet and brief is at least as accurate as packet only and follows wrong resolver holds less than brief only.

Rejection test: V3 is correct on 11 of 20 against V1 on 17. V3 and V2 each follow four of seven wrong resolver holds.

C1 with R47 escapes no more unsafe releases than C1 with R46.

Rejection test: Both escape zero, making the safety comparison uninformative. R47 routes 17 of 20 and R46 routes 18.

The validator follows a note on at least one HOLD exhibit and the gate routes every such release.

Rejection test: Live note following is zero on all 24 exhibits. The deterministic gate certificate routes all twelve counterfactual note following releases.

On live ledgers, R46 makes no more unsafe releases than R45 and removes the split condition releases.

Rejection test: E46-B: on Witness B's ledgers R45 made 3 split condition releases under the open resolver and R46 made 0 (F1 alone removed all 3); on Witness C's ledgers both made 0. The three releases came from ledgers completed post hoc the same day.

R46 adds false holds on R items relative to R45; R46c recovers them without an added unsafe release (exploratory).

Rejection test: E46-B: R46 held 5 of 5 cures on both witnesses' ledgers; R46c recovered 4 of 5 on Witness C and 1 of 5 on Witness B, with no added unsafe outcome under the open resolver.

C1 escapes no more unsafe outcomes than the better of its two components alone, at a review load below 50 percent.

Rejection test: E46-B: C1 escaped 0 but at a review load of 0.55; with R45 in place of R46 it escaped 0 at 0.30 (ablation).

Cross witness routing (C1) escapes no more unsafe outcomes than same witness routing (C2).

Rejection test: E46-B: both escaped 0; uninformative.

A reviewer given the brief only (V2) is less accurate than a reviewer given the packet (V1).

Rejection test: E46-B: V2 14 of 20 against V1 16 of 20, but V2 made 0 unsafe verdicts against 4 for V1.

On items where the brief's resolver outcome is wrong, a reviewer given packet and brief (V3) is less accurate than one given the packet only (V1).

Rejection test: E46-B: on the 5 wrong resolver items, V3 and V1 were both correct on 5 of 5.

Witness C follows a plausible note on at least one HOLD exhibit, and the unchanged gate routes every such release to review.

Rejection test: E46-C: the note was followed on 0 of 24 exhibits, so the gate had nothing to catch; structurally (E46-A) it routes every note following release to review.

On the same ledgers, R45 under the open resolver gives more correct outcomes than R44 without more unsafe releases.

Rejection test: E45-B: 52 of 60 correct and 4 unsafe under R45, against 36 and 11 under R44, on the same ledgers.

Record sets recover K2: R45 resolves K2 to PASS where R44 cannot.

Rejection test: E45-B: K2 correct 11 of 12 under R45, 2 of 12 under R44.

The scope test removes unsafe FAILs on TS under the open resolver.

Rejection test: E45-B: TS 11 of 12 held under R45; 7 of 12 unsafe under R44.

The completeness content, not an added record, drives FAIL: TC resolves FAIL far more often than TX.

Rejection test: E45-B: TC FAIL 8 of 12, TX FAIL 0 of 12.

The exploratory locality rule improves on R45 without new errors.

Rejection test: E45-B: no gain; 2 TC ledgers lost where Witness B marked the completeness record itself FAILS.

Where the resolver is wrong, the same witness reading directly is right more often than wrong.

Rejection test: E45-B, same day post hoc completion: where the R45 resolver was wrong (8 ledgers) the direct reader was right on 7.

A rewriting validator follows a misleading reviewer note on some annotated ledgers, and the unchanged gate catches the resulting releases but not the resulting holds.

Rejection test: E45-C: Witness C followed the note on 0 of 24 annotated ledgers, so the gate had nothing to catch; structurally (E45-A) the gate routes every note following release to review and accepts every note following hold.

With a record level ledger, near miss T items hold under the open resolver, and the unsafe FAIL rate on T falls well below the condition ledger's.

Rejection test: E44-B: 1 of 24 unsafe across Witnesses B, C, and D, against 12 of 16 for the condition ledger on the same 8 T items (and 14 of 18 in Round 43 on other families).

The record level ledger stays determinate where the record supports a decision: K resolves PASS, and TC resolves FAIL under both resolvers.

Rejection test: E44-B: TC 24 of 24 under both resolvers; T 24 of 24 FAIL under the closed resolver; K 17 of 24 under the open resolver, with Witnesses B and D releasing 5 unsafe FAILs under the closed resolver.

Declared open direct readers err on T items and not on TC items.

Rejection test: E44-B: 8 of 16 unsafe FAIL on T (4 per witness, the same four items) and 0 of 16 on TC.

Under the record level ledger, unsafe releases on T items do not coincide across witnesses.

Rejection test: E44-B: no shared unsafe release across three witnesses (1, 0, 0 of 8), but with one error the correlation is undefined; under the condition ledger and direct reading, errors coincided on 4 of 8 items.

The authored HOLD labels survive a blind independent review under both conventions.

Rejection test: E44-B: Witness A agreed with 48 of 48 labels; defects reported in 6 of 8 families, mostly on K packets; those families are reported separately as contested.

A gated rewriting validator makes no unsafe release on exhibit ledgers with harder seeded defects.

Rejection test: E44-C: 0 unsafe releases in 72 rewrites by Witnesses B and C, with or without the gate; the gate routed 24 correct repairs to review and caught no wrong rewrite, because none occurred.

Declaring an open record removes the direct FAIL releases on U and T items.

Rejection test: E43-B: holds on U (15 of 18 to 0 of 18) but not on T (18 of 18 to 6 of 18), so rejected as stated.

Under a declared closed record, direct readers answer FAIL on U and T items and keep K unchanged.

Rejection test: E43-B: 36 of 36 correct FAIL on U and T; K 18 of 18.

Once extraction readers can err unsafely, a witness's unsafe releases coincide across its two roles.

Rejection test: E43-B: 5 of 6 direct unsafe releases coincide with the same witness's extraction (independence 2.33); error correlation 0.16, 0.45, 0.63.

A flag only validator creates no unsafe release; a rewriting validator can.

Rejection test: E43-A: supported structurally on 96 flag outcomes and 12 span valid rewrites; E43-C: neither arm created one live, so the rewriting risk was not observed.

A flag only validator pays for its safety in false holds that it cannot repair.

Rejection test: E43-C: 12 of 12 seeded spurious condition ledgers stayed false holds under flag only.

Pairs of one witness in two roles release joint unsafe verdicts on undetermined items less often than pairs of two witnesses in the same role.

Rejection test: E42-B: 0 of 18 for role pairs against 8 of 18 for cross witness direct pairs; equal to cross witness extraction pairs (0 of 18); the mechanism is the extraction marginal.

The extraction role holds undetermined items more often than the direct role.

Rejection test: E42-B: 18 of 18 held by extraction readers against 7 of 18 by direct readers.

The extraction role pays a measurable false hold cost on determined items.

Rejection test: E42-B: 4 of 18 extraction reader false holds (Witness C none).

The real exhibit track shows the same pair ordering as the authored items.

Rejection test: E42-C: no joint unsafe release in any pair group, so the ordering is not testable.

At this pool size a zero joint rate cannot exclude a material true rate.

Rejection test: E42-A: zero events in 18 opportunities allow a true rate up to 0.153.

Items selected for disagreement show lower accuracy in sample than on held out twins, for every topology.

Rejection test: E41-A only (structural): in sample accuracy below twin accuracy for T1, T2, and the quorum at every twin fidelity; no live item was selected.

Selection for disagreement inflates the measured gap between topologies.

Rejection test: E41-A only (structural): gap 0.055 in sample against 0.028 on the twin and 0.023 on the full pool.

Families authored to be hard by construction produce screening disagreement on at least some families.

Rejection test: E41-B: 0/10 families with any screening disagreement.

Each witness gives the same verdict on both twins of a family.

Rejection test: E41-B: 40/40 witness twin pairs stable.

Disagreement selection misses consensus errors that fall on items where all witnesses agree.

Rejection test: E41-A: 13.4 percent of forced majority errors never selected; E41-B: F07 unanimous wrong on both twins.

A forced majority does not reduce unsafe releases when witnesses do not abstain.

Rejection test: E40-A: 108/243 unsafe for single and majority; 0/16 holds without abstaining witnesses.

Separating extraction from decision with a span check removes fabricated quotes as a route to release.

Rejection test: E40-A: 4/12 unsafe with span check versus 8/15 without; no live fabricated quote occurred.

Routing extractor disagreement to review raises the fewest faults for an unsafe release from one to two.

Rejection test: E40-A: T6 minimum 2 faults, 4/48 unsafe, all identical misreadings; live extractors agreed on 33/33.

Each added sequential model stage can introduce an error the single stage did not make.

Rejection test: E40-C: the validation stage produced the only composed error (X24).

Without lens instructions, witnesses return HOLD when the contract leaves a decisive conflict unresolved.

Rejection test: E40-B and E40-C: 19/20 direct HOLD-truth authored evaluations and 48/48 conditional exhibit evaluations held; Witness B released N01.

Single-record and single-lens gates release unsafely on conflicting-evidence states, while ordered CEV-39 resolution with verdict invariance eliminates unsafe releases without false holds.

Rejection test: E39-A: G0-G3 24/112 unsafe (21.43%), G4 20/112 (17.86%); G6 0 unsafe, 0 false holds (specification check).

Under a 3-of-4 quorum only a 2-2 lens split changes outcomes, and it holds exactly the outcome relevant unresolved states only for witnesses that apply contract evidence rules first.

Rejection test: E39-A lens composition: rule-following k=2 108 correct, 0 unsafe, 4 correct holds; lens-only k=2 still 8 unsafe.

Witnesses apply a designated record and a contract-required computation regardless of assigned lens.

Rejection test: E39-B: 48/48 correct on K01-K06 under both lenses.

Witnesses return HOLD when records of equal standing conflict, the contract is silent, and the outcome depends on the conflict.

Rejection test: E39-B: 0/16 HOLD on K07 and K08 (0/96 overall).

A balanced two and two lens assignment holds the clean unresolved packet while every unbalanced assignment releases it.

Rejection test: E39-B K08: held in 6/6 balanced assignments, released in 10/10 unbalanced.

The CEV-39 gate makes no unsafe release on the authored suite.

Rejection test: E39-B arm A8: 10/12 correct releases, 0/12 unsafe, 2/12 holds.

On real filed exhibits, witnesses distinguish conditional from unconditional effectiveness from the exhibit text.

Rejection test: E39-C: 31/33 completed evaluations matched the structural label; 4/4 unconditional controls correct.

In the declared 464-state post-register-closure universe, TDR-37 date-only section resolution (G2) shows both high false acceptance and severe false rejection, while full CIV-38 (G6) reaches 0% FAR and 0% FRR by construction.

Rejection test: E38-A: G2 FAR 9.15% (41 FP), FRR 81.25% (13 FN); G6 0.00% / 0.00%.

On V01-V12, TDR-37's date-only section resolver matches ground truth on only 2/12 lifecycles, whereas OpAsOf matches on 12/12.

Rejection test: E38-A resolver comparison: 2/12 vs 12/12.

Role-decorrelated witness instructions break Round 37's unanimity in View R, producing 3-1 split votes on packets whose operative validity depends on an unattached DOC-VERIF log.

Rejection test: E38-B View R: 9/12 packets split 3-1; 0/3 unconditional packets split. The splits reflect assigned lenses.

When DOC-VERIF is omitted (View R), a 3-of-4 quorum (A3) and TDR-37 (A4) still release 8/12 false certifications because three presumptive witnesses outvote one precautionary witness.

Rejection test: E38-B arms A3 and A4: 8/12 false releases each.

When DOC-VERIF is attached (View V), TDR-37 (A5) holds 10/12 valid packets because its date-only check rejects witnesses that rightly disqualify inoperative or sibling-sub-clause instruments.

Rejection test: E38-B arm A5: 10/12 false holds, 0/12 false releases.

Full CIV-38 achieves 0/12 false releases before reopen (A6, View R) and 12/12 correct releases with 0/12 holds once DOC-VERIF is attached (A7, View V).

Rejection test: E38-B: A6 0/12 false, 9/12 holds; A7 12/12 correct, 0/12 false, 0/12 holds.

With base-only packets, pointer-free post-execution instruments produce unanimous false consensus that CCS-36 reference closure does not intercept.

Rejection test: E37-B arms A2 and A3: 7/12 false releases each; 0/48 receipts flagged an unattached reference.

Reference closure and latest-executed-wins resolution leave measurable false acceptance or false rejection in the declared lifecycle universe.

Rejection test: E37-A: G1 FAR 13.68% (208 FP); G2 FRR 50.00% (8 FN).

TDR-37 with a gate-side register holds base-only packets with zero false releases.

Rejection test: E37-B arm A5: 0/12 false releases, 11/12 holds, 1 legitimate release on control L11.

With every instrument attached, temporal decoys still cause witness errors that the as-of check must catch.

Rejection test: E37-B View F: 48/48 witness answers correct and 48/48 cited the as-of controlling instrument; the as-of check never changed an outcome.

A register extract supplied inside the packet defeats TDR-37 when it is stale, and a gate-side register of record prevents those false releases.

Rejection test: E37-C: arm A7 5/12 false releases; arm A8 0/12 false releases and 11/12 holds.

Witness self-reported completeness reliably identifies stale register extracts.

Rejection test: E37-C: flags true on 5, 10, 12, and 7 of 12 packets by family; on L08 4/4 witnesses asserted completeness and 4/4 were wrong.

Applying Round 35's CIS-35 gate to a 100% locally complete primary document without cross-document reference-graph closure (G1 in E36-A; Arm 2 in E36-B) permits unanimous false certifications whenever an unattached higher-precedence companion instrument reverses the base obligation.

Rejection test: E36-A G1 accepted 126 negative states (FAR 0.77%); E36-B Arm 2 produced 6/6 unanimous 4-0 false certified releases on Stratum 1 (M01-M06).

Across an m-document reference chain with per-hop retrieval recall q = 0.85 and independent witness error p_indep = 0.15, compound reference-hop losses elevate ungated 3-of-4 quorum failure from 1.20% (m = 1) to 16.02% (m = 2), 28.62% (m = 3), 39.32% (m = 4), and 48.42% (m = 5), requiring q > q* = 96.50% at m = 3 to beat a single p_single = 0.08 full-packet auditor.

Rejection test: E36-A exact multi-hop reference-truncation derivation: q* = 0.964964 at m = 3; P_fail_quorum(3, 0.85, 0.15) = 0.286156.

Attaching all referenced documents and checking verbatim spans without verifying the contractual Order-of-Precedence DAG and active amendment execution status (G2 in E36-A) still falsely accepts 56 compromised states where witnesses apply a subordinate, superseded, or unexecuted clause.

Rejection test: E36-A: G2 accepted 56/16,376 negative states (FAR 0.34%).

Enforcing a rigid single scalar governing_section field on multi-document bundles (G3 in E36-A; Arm 2 on M09 and M10 in E36-B) causes a 75.00% (6/8) false rejection rate in E36-A and 2/12 (16.67%) false holds in E36-B, whereas CCS-36's compositional (base_entitlement_section, decisive_override_section, inline_fact_sufficiency) tuple reduces false holds to 0/8 in E36-A and 0/12 in E36-B.

Rejection test: E36-A G3 FN = 6 vs G5 FN = 0; E36-B Arm 2 held M09 and M10 fail-closed while Arms 4 and 5 certified both M09 and M10 4-0.

Across all 4^7 = 16,384 enumerated multi-document states in E36-A, the complete CCS-36 gate (G5_ccs36_full) achieves TP = 8, FP = 0, TN = 16,376, FN = 0 (0.00% FAR, 0.00% FRR, 100.00% accuracy).

Rejection test: E36-A: G5 achieved TP 8, FP 0, TN 16,376, FN 0 ().

On the 12-packet live 4-architecture benchmark (E36-B), applying CCS-36 prior to bundle reopen (Arm 4) intercepts 6/6 Stratum-1 dangling-override packets (M01-M06) fail-closed (HOLD_CCS36_DANGLING_REF_CLOSURE) with 0/12 false certified releases, while ungated 4-family voting (Arm 3) and local CIS-35 (Arm 2) both suffer 6/6 unanimous 4-0 false certified releases.

Rejection test: E36-B Arm 4: 0/12 false certified releases, 6/6 Stratum-1 packets held fail-closed with 4/4 witnesses flagging unattached_external_reference = true.

Once CCS-36 reopens the transitive multi-document bundle (Arm 5 in E36-B), all 6/6 Stratum-1 packets flip from 4-0 false consensus to 4-0 verified correct consensus and all 6/6 Stratum-2 packets (M07-M12, including M09 and M10) release cleanly, achieving 12/12 (100.00%) correct certified releases, 0/12 false releases, and 0/12 holds.

Rejection test: E36-B Arm 5: 12/12 certified correct releases, 0/12 false releases, 0/12 holds across 108 live evaluations ().

On post-GTP-34 witness panels (|R_G(Q)| >= 3), releasing solely on 3-of-4 top-level verdict agreement (G0) produces a 100.00% false acceptance rate across the 4,088 semantically compromised configurations in E35-A.

Rejection test: E35-A: G0 accepted 4,088/4,088 negative states (FAR 100.00%).

Adding 4-family witness architecture diversity (Witness A, Witness B, Witness C, Witness D) without canonical context-completeness and override gating fails to prevent unanimous false consensus when witnesses share a truncated retrieval slice (C05-C08).

Rejection test: E35-A G1 FAR 49.90% (2,040/4,088); E35-B Arm 3 produced 4/4 unanimous 4-0 false consensus on Stratum 2.

Checking only that each witness's cited quote is a verbatim substring of the document (G2) still falsely accepts 49.90% (2,040/4,088) of compromised panels because witnesses cite verbatim text from a superseded base clause rather than the governing override clause.

Rejection test: E35-A: G2 accepted 2,040/4,088 negative states (FAR 49.90%).

The conjunction of AIC-33/GTP-34 grounding, canonical bundle digest matching, at least 3 model families, verbatim governing-span verification, and override-chain reconciliation (G5) achieves 0.00% false acceptance and 0.00% false rejection across the 4,096-state diagnostic.

Rejection test: E35-A: G5 achieved TP 8, FP 0, TN 4,088, FN 0.

For marginal witness error p = 0.25, a 3-of-4 majority quorum exceeds the 10.00% error rate of a single p_single = 0.10 checker whenever pairwise failure correlation rho >= 0.2471 (and reaches 12.05% at rho = 0.35).

Rejection test: E35-A exact Eckhardt-Lee common-shock derivation: rho* = 0.24706; P_fail(0.25, 0.35) = 0.120508.

On the 12-case live multi-model benchmark (E35-B), CIS-35 reduces false certified releases from 4/12 (33.33%) under ungated homogeneous and ungated multi-family quorums to 0/12 (0.00%), catching 4/4 truncated-slice traps (C05-C08) fail-closed and recovering 4/4 correct certified releases once the canonical bundle is supplied.

Rejection test: E35-B Arms 4 and 5: 0/12 false certified releases; 4/4 Stratum-2 cases held on slices and certified correct 4-0 on the canonical bundle.

Requiring strict governing-section label agreement and cross-reference completeness across four distinct model families introduces a nonzero conservative hold rate on clean/complete cases (2/12 = 16.67% in E35-B, specifically C03 and C12) without emitting any false certified release.

Rejection test: E35-B Arm 5: HOLD_CIS35_GATE on C03 and C12 despite 4-0 correct verdicts; 0/12 false certified releases.

For any fixture whose complete signer paths remain inside a strongly connected component with no configured anchor, GTP-34 will never return `certified`, regardless of the number of valid signatures inside the component.

Rejection test: one such fixture receives `certified` without an explicit policy that preconfigured the component as an anchor.

When the action requires `q` independent roots, GTP-34 will not count multiple witness paths terminating at the same administrative root more than once.

Rejection test: a `q=3` action is certified with fewer than three distinct accepted administrative roots.

Timeouts, missing intermediates, depth limits, and lookup failures will increase `unproven`, never create a new accepted root.

Rejection test: removing path information or reducing the search budget changes an otherwise identical result from `unproven` or `invalid` to `certified`.

An in-band anchor update will be accepted only when authorized under the current anchor policy and the proposed new policy, except during a separately authenticated recovery event.

Rejection test: a new root becomes active solely through its own signature or signatures traceable only to that new root.

Any deterministic classifier restricted to E34-A's depth-`d` projection will incur at least 39,960, 7,776, and 648 errors for `d=1,2,3`, respectively, over the full uniform universe.

Rejection test: a reproducible classifier using only the recorded projection achieves fewer errors. Such a result would indicate an implementation or equivalence-accounting defect.

On independently authored structural fixtures, GTP-34 will reduce critical false certification relative to distinct-key, immediate-issuer, reachability-only, and fail-open baselines without changing the anchor store after seeing fixture labels.

Rejection test: GTP-34 fails to improve critical false certification, relies on post-label trust-store edits, or its gain disappears under a matched verification budget.

After A3, I1, R4, R5, and C6 are present, root-gated collaboration will reduce final-answer error or harmful revision on shared-cause fault tasks relative to raw 3-of-4 voting at the same total model and tool budget, without a prespecified unacceptable regression on clean tasks.

Rejection test: no reliable benefit, excessive clean-case abstention, worse calibration, or increased harmful revision under the preregistered analysis.

On adversarial common-controller aliases, distinct keys plus self-attested root claims will not reduce false certification relative to key count alone.

Rejection test: Proposed Round 34 three-root external pilot; untested in Round 33, whose results are exact combinatorial counts over a declared finite universe.

Conservative externally anchored coverage will never increase the set of certified witness coalitions when it reveals a shared root.

Rejection test: Proposed Round 34 three-root external pilot; untested in Round 33.

Fail-closed handling of missing critical layers will reduce false certifications relative to optimistic handling, at the cost of more unproven outcomes.

Rejection test: Proposed Round 34 three-root external pilot; untested in Round 33.

Among coalitions with AIC-33 certificates, higher validated structural separation will reduce joint semantic miss rate on hidden common-mode evidence faults at matched compute.

Rejection test: Proposed matched-compute model experiment after A3, I1, R4 and R5 are present and C6 is activated; untested in Round 33.

Any semantic gain will not be counted as success if clean-case rejection, harmful answer revision, or abstention burden exceeds preregistered limits.

Rejection test: Proposed matched-compute model experiment; untested in Round 33.

Declared stack heterogeneity without administrative or evidence-root separation will not match the benefit of heterogeneity plus anchored separation.

Rejection test: Proposed matched-compute model experiment; untested in Round 33.

A separately administered witness plus an independently monitored append-only registry will eliminate the shared-admin alias under the stated threat model, provided at least one authority remains honest and reachable.

Rejection test: Proposed Round 33 external-authority experiment; untested in Round 32.

When model calls and prompts are held fixed, adding externally anchored execution evidence will reduce false correction and harmful revision more than it reduces beneficial correction.

Rejection test: Proposed Round 33 external-authority experiment; untested in Round 32.

Per-case namespace, nonce, canary, and decoy separation will reduce cross-arm contamination relative to shared caches even when task content is semantically similar.

Rejection test: Proposed Round 33 external-authority experiment; untested in Round 32.

A threshold witness scheme will outperform a single external witness under one-witness compromise but will introduce availability and latency regressions that require explicit abstention rules.

Rejection test: Proposed Round 33 external-authority experiment; untested in Round 32.

When the same executor authors both the action and success claim, adding a valid signature will not materially improve detection of off-target, partial, false-success, or stale-readback faults relative to unsigned self-report.

Rejection test: Reject this hypothesis if a frozen holdout shows that executor signing alone improves fault detection for reasons not attributable to leaked labels or different information. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

Comparing frozen intent with a separately signed direct observation will detect at least 95% of off-target, partial, false-success, and stale-readback holdout faults at no more than 2% false rejection on clean cases.

Rejection test: either sensitivity or clean-case specificity misses its threshold on the frozen holdout. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

Cache and memory receipts plus hidden canaries reduce undetected spillover by at least 75% relative to a direct-action witness without exposure telemetry, with false-positive rate below 5%.

Rejection test: the relative reduction or false-positive threshold is missed on varied hidden canaries and spillover routes. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

A candidate-set representation with `unresolved_equivalence` reduces false root-independence by at least 30% relative to forced binary classification while retaining at least 70% structural-decision coverage.

Rejection test: the full experiment misses either error reduction or coverage floor. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

Moving the witness signer and receipt registry into separately administered, policy-enforced services and running each arm in an ephemeral isolated environment will close A3, I1, R4, and R5 without introducing more than 2% accounting overhead or unacceptable operational failure.

Rejection test: compromise tests show shared control, key exposure, history rewriting, cross-arm contamination, or budget overrun. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

Once the infrastructure gate passes, full RISE will reduce false-root independence and harmful revision relative to the strongest active baseline at matched total compute, without more than a 1.5 percentage-point answer-accuracy loss.

Rejection test: the primary endpoints do not improve, regression margins are crossed, or benefits disappear under identifier blinding. Round 31 observations are limited to authored fixtures; holdout validation remains proposed.

At the audited snapshot, the current E29-B path fails at least one critical Root, Intervention, Separation, Receipt, and Equivalence control.

Rejection test: Independent reviewers reproduce the manifest. Reject if every critical control is demonstrated end to end with executable evidence.

The dual-path comparator detects at least 80% of injected off-target, partial and false-success actions and improves detection by at least 20 percentage points over signed self-report at the same action count.

Rejection test: Reject if either threshold is missed on the preregistered holdout.

Per-arm cache and memory receipts plus canaries reduce undetected contamination by at least 75% relative to logical arm labels alone.

Rejection test: Reject if the relative reduction is smaller or false-positive rate exceeds 5%.

An unresolved-equivalence state reduces false root-independence by at least 30% while retaining at least 70% structural-decision coverage.

Rejection test: Reject if the reduction or coverage floor is missed.

Full RISE lowers false-root-independence and harmful revision relative to the best active baseline at matched total compute, without more than a 1.5 percentage-point loss in accuracy or a 2% compute-budget overrun.

Rejection test: Reject if endpoints do not improve, regression margins are exceeded, or gains disappear when identifier leakage is removed.

Within a correctly specified finite response-function family, an adaptive separating policy will decide the target behavioral-dependency predicate more often than passive repetition at equal total cost.

Rejection test: the paired, matched-cost lower confidence bound on improvement is at or below zero, or the gain vanishes under held-out mechanisms.

When separate-root and shared-root implementations are interventionally equivalent under the admissible content interface, no content-only policy will outperform the prior on root provenance.

Rejection test: a leakage-free content-only trace contains reproducible information that separates a paired provenance twin.

Requiring verified action receipts will reduce false-clean dependency judgments under unknown and off-target interventions compared with trusting intended targets.

Rejection test: the preregistered false-clean rate does not fall at matched coverage and cost, or if overall decision loss increases beyond the tolerance margin.

Verified root rotation plus path isolation will reduce prospective shared-failure correlation and false corroboration more than content perturbation alone.

Rejection test: the rotated channel retains matched-root failure correlation or does not improve dependency detection under an independently audited receipt.

Stopping when all surviving candidates share the same decision label will preserve target decision accuracy while using fewer interventions than full graph identification.

Rejection test: target decision error exceeds the preregistered non-inferiority margin or total measured cost fails to decrease.

Certificates formed without reserved out-of-version-space validation will exhibit a higher false-clean rate on omitted mechanisms than certificates with a reserved validation action.

Rejection test: the reserved action produces no improvement across preregistered omitted-mechanism strata at matched cost.

For every evaluated history generated by a declared model with matched prior and likelihood, the exact conditional target probability lies inside the reported model interval.

Rejection test: 100% weighted history coverage, with any miss treated as an implementation or premise failure.

At matched coverage, TSAR's conservative set risk yields lower delayed-correction risk than pooled scalar risk across both declared variants and all preregistered priors.

Rejection test: lower risk in a clear majority of cells, no meaningful harmful subgroup regression, and improved risk Brier score.

Surprise, interval width, or compatibility detects the held-out hidden-common-origin variant with AUROC at least 0.75 and useful precision above prevalence.

Rejection test: E28-A: Falsified for this stress. Maximum AUROC is 0.577; compatibility itself is uninformative.

Replacing one passive repeat check with a provenance-changing intervention will raise held-out model detection above AUROC 0.75 and reduce false-clean rate at equal total cost.

Rejection test: Untested. Round 29 active dependency interventions.

On a preregistered multi-agent benchmark with delayed adjudication, an interoperable TSAR schema will improve correction-risk Brier score and 90%-coverage risk over a one-number confidence message, without reducing task accuracy or increasing total compute/tool cost.

Rejection test: Untested. Preregistered live-agent transfer study.

For every scenario inside a correctly specified finite model set, a target-unanimity gate will never emit the wrong categorical target.

Rejection test: Executable in-model trace retaining the actual scenario. Rejection condition: Any trace emits the opposite target.

At matched compute in strata with correlated evidence roots, a model-set gate will have a lower harmful false-clean rate than a nominal independence gate, while retaining nonzero correct resolution.

Rejection test: Matched-compute strata with hidden adjudication. Rejection condition: No reduction in false clean, or reduction only by near-total abstention beyond the preregistered utility boundary.

Given the same declared model, costs, and planning distribution, finite-horizon optimization will weakly dominate any included fixed schedule on expected categorical resolution.

Rejection test: Exhaustive comparison under identical state, action, cost, and prior definitions. Rejection condition: A fixed schedule with higher expected resolution.

A greedy next-check policy can underperform a target-first fixed schedule because an attractive immediate reduction can block an affordable completing path.

Rejection test: Greedy versus fixed target-first comparison. Rejection condition: Myopic adaptivity never underperforms the fixed schedule.

When apparently independent checks share an omitted root, increasing budget can increase the conditional false-clean rate.

Rejection test: Hidden-adjudication common-origin strata. Rejection condition: False confidence never increases with budget after controlling for policy and coverage.

A scheduler that models both target value and check efficacy will improve cost-to-correct-resolution or selective risk under shifts in check reliability.

Rejection test: Efficacy-conditioning ablation. Rejection condition: No improvement over reward-only and cost-only ablations, or degraded worst-stratum harm.

Among abstained cases, the recorded number and structure of cross-target scenario pairs will predict which additional checks later change the answer.

Rejection test: Locked future-correction prediction. Rejection condition: Residual ambiguity features do not outperform simple uncertainty or random rankings.

Under one injected silent-root fault, SACP plus one genuinely independent target channel has fewer harmful false-stability certificates than SACP at matched total cost.

Rejection test: Paired sandbox windows with hidden adjudication. Rejection condition: No improvement, or any improvement disappears after cost matching.

Three root-disjoint target channels are sufficient against two modeled silent-root failures in the implementation.

Rejection test: Mutation coverage over all two-root combinations. Rejection condition: Any changed world is certified clean without an assumption violation.

Removing or falsifying root-lineage metadata increases false stability under common-origin witness failures.

Rejection test: Independent versus mirrored witness ablation. Rejection condition: No difference in residual ambiguity or harmful decisions.

Health-only checks improve abstention and reduce false certification for visible path failures but do not detect healthy-looking selective non-emission.

Rejection test: Heartbeat, acknowledgment, and canary ablations. Rejection condition: Health-only checks identify silent issuer omission without becoming target-sensitive.

Additional LLM agents sharing the same evidence root do not match one independent external channel at equal inference and observation cost.

Rejection test: Same-root agent ensemble versus independent-channel policy. Rejection condition: Same-root ensemble matches or exceeds on false stability without regressions.

Ambiguity-directed probes reduce residual pair weight per observation unit relative to fixed and random probes.

Rejection test: Active-probe ablation with frozen candidate pool. Rejection condition: The preregistered paired interval includes no improvement or favors baselines.

OSC's safety gain is not fully explained by abstention.

Rejection test: Joint analysis of false stability and useful-current availability. Rejection condition: False stability falls only by exceeding the preregistered abstention or availability margin.

Under equal total verification budget, CTAG will produce a lower stale-claim escape rate than no invalidation, fixed-file watchlists, filename heuristics, and periodic expiry.

Rejection test: E22-B prospective evaluation.

At matched affected-claim recall, CTAG will revalidate fewer unaffected claims than retest-all and periodic expiry.

Rejection test: E22-B prospective evaluation.

Execution-path closure and unknown-path fail-closed rules will reduce misses for negative claims compared with direct-file watchlists.

Rejection test: E22-B prospective evaluation.

Separating historical_frozen from current states will reduce misleading carry-forward while preserving reproducibility and citation stability.

Rejection test: E22-B prospective evaluation.

Change-triggered revalidation will achieve equal or lower stale-claim escape than fixed time-to-live refresh at lower total revalidation cost.

Rejection test: E22-B prospective evaluation.

Comparing authored dependencies with runtime or static dependency evidence will catch manifest omissions that either method alone misses.

Rejection test: E22-B prospective evaluation.

The boundary-tapped ABMG collector reconstructs at least 99.5 percent of external-service attempts exactly and improves reconstructability by at least 20 percentage points over the current collector on the same traffic.

Rejection test: E21-B shadow experiment; untested.

Under injected single-write, process-crash, and retry-race failures, false audit_qualified_released is at most 0.1 percent with a two-sided 95 percent upper confidence bound at or below 0.5 percent.

Rejection test: E21-B shadow experiment; untested.

Under truncated streams, malformed events, and HTTP-200-then-error cases, false-complete classification is at most 0.1 percent and recall for valid complete streams is at least 99.5 percent.

Rejection test: E21-B shadow experiment; untested.

With model calls held identical, A1 instrumentation adds at most 5 ms median and 20 ms p95 synchronous latency, at most 15 KB median content-free storage per external-service call, and no statistically or practically meaningful answer-quality regression.

Rejection test: E21-B shadow experiment; untested.

Reviewers given ABMG traces reconstruct attempt lineage and terminal status at least 30 percent faster, with at least 95 percent correctness, than reviewers given current traces.

Rejection test: E21-B shadow experiment; untested.

The boundary tap outperforms an otherwise equivalent post-hoc collector under envelope mutation and fallback.

Rejection test: E21-B shadow experiment; untested.

Under authorized reveal, MDIR reaches at least 0.95 exact exposure reconstruction with no more than a 0.03 absolute deficit from inline logging, while routine raw sensitive bytes remain zero.

Rejection test: B2 versus A2 on frozen synthetic trajectories; untested.

An independent checkpoint detects at least 0.99 of seeded post-checkpoint operator rewrites with false-alarm rate at most 0.01, outperforming operator-only chains by at least 0.20 absolute detection.

Rejection test: B2 versus B1 under the rewrite model; untested.

Median reviewer time for MDIR stays within 25 percent of inline logging, and false integrity assurance does not exceed it by more than 0.01.

Rejection test: Blinded reviewer task; untested.

At the synthetic live boundary, p95 receipt creation plus durable checkpoint enqueue stays under the stricter of 5 ms or 5 percent of non-model orchestration latency, with median public receipt size under 2 KiB.

Rejection test: Live-boundary measurement; untested.

B0 exposure ledgers increase exact evidence-exposure reconstruction over A1.

Rejection test: Proposed replay comparison over identical frozen trajectories; untested.

B1 claim lineage improves exact first-divergence localization over B0 without increasing false causal attribution.

Rejection test: Proposed blinded localization task; untested.

An external-content mode using version, digest, length, locator and access receipt reduces routinely captured sensitive bytes while preserving identity reconstruction.

Rejection test: Proposed comparison against inline B1; untested.

Bitemporal selection improves historical-now and as-known accuracy over deterministic newest-recorded selection at the frozen budget.

Rejection test: B0 versus T0; untested. Rejected as an architectural requirement if T0 falls within the equivalence interval or wins on utility-adjusted cost.

Dependency-directed repair improves downstream-consequence correctness beyond bitemporal selection alone.

Rejection test: B1 versus B0 with negative controls for harmful revision and false invalidation; untested.

An explicit disputed state reduces unsupported commitment without collapsing supported coverage.

Rejection test: B1 versus O0 on unresolved-overlap and answerable non-conflict episodes; untested.

Under the same explicit scope check, a structured record improves changed-question supported completion over strong prose without unacceptable damage or cost.

Rejection test: S1 versus P1 at one budget; untested. Rejected as an architectural requirement if strong prose performs equivalently or wins at lower cost.

An explicit scope check recovers confident omissions on changed-question cases.

Rejection test: P1 versus P0 and S1 versus S0 against unrestricted discretionary lookup; untested.

Reopening helps only when it supplies usable evidence.

Rejection test: Compare cases with unavailable or unfindable evidence; untested.

Validated alternatives improve supported task completion and reduce unsupported commitment relative to a strong checklist at the same budget.

Rejection test: B2 versus B1 on held-out source families; untested with language models. Provisional benefit and harm margins must be frozen before confirmation.

Scope discovery helps more when a relevant rule is absent from the representation than when only a named value is missing.

Rejection test: B3 versus B2 interaction with the catalog-only checklist ablation; untested with language models.

Decision relevance preserves useful completion on sufficient and irrelevant-unknown controls while reducing unsupported closure.

Rejection test: Measure broad refusal, invented conditions, needless acquisition, and damage; untested with language models.

Evaluation error differs meaningfully between ordinary and receipt-based revision outputs.

Rejection test: Paired difference between judge and reference contrasts against a 2-point practical threshold, with identity-hidden format controls.

The protected-audit protocol makes more correct, informative promotion decisions than naive judge or disagreement-only evaluation at the same budget.

Rejection test: False and correct promotion, interval width, and inconclusive frequency against executable truth, then a separate semantic reference.

Valid joint constraints reduce evaluation uncertainty at useful cost.

Rejection test: Joint versus independent per-snapshot sets on naturally occurring paired outputs; proposed 25% median width reduction where coupling is nontrivial.

Evidence receipts at the revision boundary improve task success over ordinary reconsideration.

Rejection test: Local revision pilot, arms B vs C at comparable cost.

Terminal evidence-and-revision features improve held-out release coverage by at least five points at a 2% selective-risk target.

Rejection test: Lower confidence limit of the paired coverage difference must exceed five points.

Revision state adds information beyond task difficulty.

Rejection test: Ablate revision features within strata.

Answer binding catches content changed after scoring.

Rejection test: Detection recall on a labelled mutation set.

Pooled performance conceals predictable regressions in revised and conflicted episodes.

Rejection test: Held-out stratum risk-coverage curves.

A repair/damage-predicting controller improves task success over a whole-answer router at a fixed cost ceiling.

Rejection test: At least two points, paired 95% interval excluding zero.

Increased checking does not raise harmful revisions beyond 0.5 points.

Rejection test: One-sided 97.5% noninferiority bound.

Bundled checks help on complementary-evidence tasks after overhead.

Rejection test: Compare to a fixed two-step bundle under end-to-end accounting.

Predicted usefulness outperforms uncertainty-first routing on matched pairs.

Rejection test: Pairs matched for initial uncertainty.

Gap recall: At fixed total monitoring and revalidation budget, SACP reduces independently adjudicated affected-claim gap misses versus receipts-only, heartbeat-only, checkpoint-sequence, and periodic-expiry baselines.

Rejection test: E25-B prospective experiment.

Availability: SACP preserves more correctly current claim-hours than revalidate-all while staying within a preregistered non-inferiority margin for affected-claim gap recall.

Rejection test: E25-B prospective experiment.

Lineage: Removing root-lineage checks increases misses for mirrored/common-origin failures without reducing detection of independently rooted conflicts.

Rejection test: E25-B prospective experiment.

Maturity window: Removing the reorder maturity window increases false observation gaps on delayed but complete streams.

Rejection test: E25-B prospective experiment.

Challenges: Removing challenge canaries increases detection delay for observer crashes and stale checkpoint freezes.

Rejection test: E25-B prospective experiment.

Independent reconciliation: Removing separately rooted reconciliation increases misses for selective non-emission and equivocation.

Rejection test: E25-B prospective experiment.

Expectation weighting: At the same total challenge count, authority-specific expectation-weighted scheduling improves gap recall or detection delay without increasing false suspicion versus uniform scheduling.

Rejection test: E25-B prospective experiment.

Scoped state: Claim-scoped gap projection reduces unnecessary claim withdrawal versus authority-wide or registry-wide fail-closed policies without increasing stale-claim escape.

Rejection test: E25-B prospective experiment.

User-facing honesty: Explicit `unknown_observation_gap` status reduces unsupported current claims without causing more abandonment or misunderstanding than a generic stale label in a blinded review.

Rejection test: E25-B prospective experiment.

Complexity: A simpler checkpoint-sequence-plus-end-to-end-probe policy matches SACP on safety, availability, and cost. Support for this hypothesis would reject the need for full SACP.

Rejection test: E25-B prospective experiment.

authority-gap recall: Across a preregistered prospective window, ALR will leave fewer independently adjudicated affected claims current after non-repository changes than the Round 23 repository union at the same total event-inspection and claim-revalidation budget.

Rejection test: E24-B prospective experiment.

unique authority value: Removing each of deployment, live-database, service-contract, and runtime observers will create at least one unique stale-claim escape in the corresponding held-out authority stratum.

Rejection test: E24-B prospective experiment.

typed selectivity: At matched stale-claim escape, typed authority-to-claim mapping will produce fewer false-invalidated claims and fewer reviewer minutes than authority broadcast or retest-all.

Rejection test: E24-B prospective experiment.

unknown handling: Authority-bounded fail-closed handling will reduce stale-claim escape relative to treating unknown events as irrelevant, without increasing false-invalidated claim time by more than a preregistered noninferiority margin.

Rejection test: E24-B prospective experiment.

scope honesty: Adding `current_within_observed_authorities` and `unknown_authority_gap` will reduce public universal-current claims unsupported by current authority evidence to zero, without reducing accurately scoped publication coverage by more than five percentage points.

Rejection test: E24-B prospective experiment.

lineage integrity: Every event used to restore a claim will retain a verifiable chain to its root authority, observer version, issuer, freshness policy, and revalidation procedure; any missing field must block restoration.

Rejection test: E24-B prospective experiment.

common-cause awareness: When two views share a root authority, ancestry-aware integration will produce fewer false assurances than naive view counting at equal claim coverage, measured on correlated-miss probes and prospective events.

Rejection test: E24-B prospective experiment.

total cost: Monitoring, verification, graph maintenance, privacy review, and revalidation labor for ALR will remain below retest-all at matched stale-claim escape over the full prospective window.

Rejection test: E24-B prospective experiment.

Stale-claim escape: across a preregistered multi-release window, the hybrid will leave fewer independently adjudicated affected claims current than the frozen exact-path manifest at the same claim-revalidation budget.

Rejection test: E23-B prospective experiment.

Unique-view value: removing the static-import view will increase affected-artifact false negatives on at least one held-out release without an equal reduction in false-invalidated claims.

Rejection test: E23-B prospective experiment.

Unknown-path value: removing the fail-closed unknown rule will increase stale-claim escape on held-out adapter, configuration, or execution-path changes.

Rejection test: E23-B prospective experiment.

Selectivity: at equal stale-claim escape, the hybrid will select fewer artifact-review tasks and fewer unaffected claims than retest-all.

Rejection test: E23-B prospective experiment.

Availability: the hybrid plus cached claim-specific procedures will maintain greater useful-current availability over time than a policy that expires all current claims on every production change.

Rejection test: E23-B prospective experiment.

Lifecycle integrity: neither selector execution nor revalidation will rewrite historical findings or upgrade untested hypotheses in any evaluated release.

Rejection test: E23-B prospective experiment.

Cost: end-to-end review labor, including graph maintenance and selector triage, will be lower for the hybrid than retest-all at matched stale-claim escape.

Rejection test: E23-B prospective experiment.

Mismatch trigger: revalidation triggered by a typed dependency mismatch will achieve lower unnecessary revalidation than periodic expiry at matched stale-claim escape.

Rejection test: E23-B prospective experiment.

Exchanging evidence makes corrections more reusable than exchanging conclusions.

Rejection test: Six comparison arms with a falsification plan.